+AC-02(09) Restrictions on Use of Shared and Group Accounts

AC-02(09) Restrictions on Use of Shared and Group Accounts

Control

Only permit the use of shared and group accounts that meet [Assignement: conditions].

Discussion

Before permitting the use of shared or group accounts, organizations consider the increased risk due to the lack of accountability with such accounts.

Assessment Objective

the use of shared and group accounts is only permitted if [Assignement: conditions] are met.

Assessment Method

Examine

Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation system-generated list of shared/group accounts and associated roles system audit records system security plan other relevant documents or records

Interview

Organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by AC-02(09) Restrictions on Use of Shared and Group Accounts – Assessment Procedure
is blocked by Restrictions on Shared Groups / Accounts